Eugeny Russh
25 CVEs affecting Eugeny Russh. Latest disclosed: 2026-10-28. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102823 | High | 7.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTEN… |
CVE-2026-48110 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-co… |
CVE-2026-46702 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets w… |
CVE-2026-46673 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocat… |
CVE-2026-42189 | High | 7.5 | 2026-05-08 | Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-inte… |
CVE-2024-43410 | High | 7.5 | 2024-08-21 | Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet cons… |
CVE-2026-102821 | Medium | 6.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INI… |
CVE-2026-68930 | Medium | 6.5 | 2026-08-03 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opene… |
CVE-2026-48107 | Medium | 6.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a mali… |
CVE-2025-54804 | Medium | 6.5 | 2025-08-05 | Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free spac… |
CVE-2026-102820 | Medium | 6.2 | 2026-09-29 | pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pag… |
CVE-2026-73430 | Medium | 5.3 | 2026-08-12 | Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with… |
CVE-2026-73429 | Medium | 5.3 | 2026-08-12 | Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containin… |
CVE-2026-48108 | Medium | 5.3 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as… |
CVE-2026-46705 | Medium | 5.3 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth… |
CVE-2026-116774 | Medium | 4.3 | 2026-10-27 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer… |
CVE-2026-116773 | Medium | 4.3 | 2026-10-27 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::process_packet path in r… |
CVE-2026-111061 | Medium | 4.3 | 2026-10-19 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-live… |
CVE-2026-102824 | Medium | 4.3 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all… |
CVE-2026-73489 | Medium | 4.3 | 2026-08-13 | Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request wi… |